ClawHub
Back to skill

Security audit

stuffed-toy-generator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a documentation-only connector for generating toy designs and 3D models through an external gateway, with privacy and API-key handling caveats.

Install only if you are comfortable sending toy prompts, image URLs, and related generation metadata to OneKey Agent Gateway and downstream 3D providers. Keep the DEEPNLP_ONEKEY_ROUTER_ACCESS key secret, avoid pasting real keys into shared chats or logs, and rotate the key if it may have been exposed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly routes user prompts and image URLs to an external gateway and downstream third-party 3D generation providers, but it does not clearly warn users that their content leaves the local environment. This can cause unintended disclosure of sensitive prompts, proprietary designs, or private image URLs because users may reasonably assume inputs are handled only within the agent ecosystem.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The documentation instructs users to export an access key into their shell environment without warning about secret handling risks. In practice, such keys are often exposed through shell history, terminal recordings, CI logs, shared sessions, or copied commands, which could allow unauthorized use of the gateway account and consumption of paid credits or access to related resources.

Static analysis

No suspicious patterns detected.